Privacy Policy

Website chat

When you send a message in the website chat, we save your message, the AI reply (including partial replies), timestamps, demo navigation actions, and reply status in Supabase for the Wandero team to review and improve responses. OpenAI processes the conversation to generate replies. Please do not submit passwords, payment details, or other sensitive information.

A first-party cookie links your chat requests to an anonymous browser identifier. We also use a keyed hash of your network address for abuse prevention; raw network addresses are not saved in these chat tables. When website analytics is available and you have not opted out, we automatically save approximate IP-based country, region and city (when available), browser/device category, language, time zone, page path, referring domain and basic campaign labels, and link the conversation to your PostHog analytics visitor and session IDs when analytics is available. Location may be inaccurate because of VPNs or network routing; we do not request GPS location. Chat text is not sent to PostHog. Do Not Track, Global Privacy Control and PostHog opt-outs suppress this visit context. An analytics opt-out clears saved context from this conversation on your next submitted message; it does not delete prior analytics events. Refreshing the page or selecting New chat clears the visible conversation but does not delete saved records. Access to saved conversations is restricted to authorized staff. To ask about access or deletion, contact hello@wandero.ai and include the approximate chat date and a description that helps us identify your conversation. Website chat records follow the data-retention principles below.

1. Introduction

Welcome to Wandero AI, your personalized travel companion powered by artificial intelligence. We respect your privacy and are committed to being transparent about how we handle your personal data. This Privacy Policy explains what information we collect, how we use it, and what rights you have depending on where you live.

Wandero AI operates globally, so this policy includes provisions for both:

• Global users (GDPR / international)
• U.S. users (California CCPA/CPRA, Virginia, Colorado, and other state privacy laws)

2. Who We Are

Wandero AI ("we", "our", "us") is operated by Wandero Inc, registered in the USA. We act as the data controller for personal data collected through our websites, web platform, mobile applications, and related integrations.

3. What We Collect

When you use our services, we may collect the following information:

We collect this data through our websites, web platform, mobile applications, and related integrations (e.g., analytics, payment, or CRM tools).

Wandero's mobile applications are available for iOS and Android. They may request access to your camera, microphone, or photo library so you can capture, select, save, or upload media to your workspace. You can manage these permissions through your device settings.

4. How and Why We Use Your Information

5. Cookies and Tracking

On our websites and web platform, we use cookies and browser-based technologies to:

• Keep you signed in
• Remember preferences
• Analyze performance and improve our product

6. Data Sharing and Transfers

We may share your data with:

• Service providers (hosting, analytics, payments) under strict contracts.
• Business partners (DMCs, travel agencies) only when necessary to fulfill a request.
• Authorities, when required by law.
• Corporate events (merger, acquisition) under data-protection safeguards.

7. Data Retention

We retain personal data only as long as necessary for operational, legal, and analytical purposes:

• Account data → while your account is active + up to 12 months after deletion.
• Billing & payments → as required by law (typically 5-7 years).
• Analytics data → anonymized or deleted after analysis.

When no longer needed, we delete or anonymize your data securely.

8. Your Privacy Rights (Global)

If you are in the EU, UK, or another GDPR jurisdiction, you have the following rights:

• Access - request a copy of your data.
• Rectification - correct inaccuracies.
• Erasure - request deletion ("right to be forgotten").
• Restriction - limit how we process data.
• Portability - receive your data in a transferable format.
• Objection - stop processing for legitimate interest or marketing.
• Automated decisions - request human review for automated decisions.

9. U.S. Privacy Addendum

For users residing in the United States, this section describes additional rights and obligations under the California Consumer Privacy Act (CCPA/CPRA) and similar state laws.

Categories of Personal Information Collected

Your Rights (U.S. Residents)

Depending on your state, you may have the right to:

• Access: Request details about personal data collected.
• Correction: Ask us to fix inaccurate information.
• Deletion: Request deletion of your personal data.
• Portability: Receive a copy of your data.
• Opt-out: Ask us not to sell or share data for cross-context behavioral advertising.
• Limit use of sensitive data: (if applicable).

10. Security

We apply industry-standard security measures:

• Data encryption (in transit and at rest)
• Access control and authentication
• Secure cloud infrastructure
• Employee confidentiality agreements
• Regular security testing

11. Children's Privacy

12. Updates to This Policy

We may revise this policy from time to time. When we do, we will:

• Update the "Last updated" date above, and
• Notify you if changes are significant.

13. Contact Us

If you have questions, concerns, or wish to exercise your rights:

14. Google API Limited Use Disclosure

Wandero AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scope of Access

When you connect Google Workspace, Wandero requests basic profile information and only the service permissions needed for the integration you select. These currently include Gmail read, send, label, and basic-settings permissions; Calendar read and event-management permissions; and the full Google Drive scope https://www.googleapis.com/auth/drive.

• Gmail: Identify travel messages, build itinerary records, organize relevant conversations, and send correspondence you request.
• Calendar: Display calendars and create, update, or delete events when you use those Wandero features.
• Drive: Search, view, download, create, edit, move, and share files when you request a Drive task. The full scope technically permits deletion of any connected Drive file; Wandero blocks permanent deletion and emptying trash, and only permits moving a specific file to trash when explicitly requested.
• Automated processing: Relevant content may be processed by Wandero and contracted processors, including AI providers, only to deliver the user-facing feature or action you requested.

Specific Restrictions

• No Advertising: We do not use Google Workspace data for serving, targeting, or personalizing advertisements.
• No Data Selling: We do not sell your Google Workspace data to third parties.
• Human Review: Our personnel may access Google Workspace data only with your affirmative agreement for a specific support case, when necessary for security or abuse investigation, or when required by law.
• No AI Training: We do not use Google Workspace data to train generalized AI/ML models.
• Disconnect and deletion: Disconnecting removes stored credentials for that connection and stops active Drive-enabled Wandero sandboxes. Account deletion clears connected Google tokens, requests provider revocation, and terminates active sandboxes. Copies you intentionally save in your Wandero workspace remain subject to the retention and deletion terms in this policy.